CVE-2024-13561 is a stored cross-site scripting vulnerability (CWE-79) in the Target Video Easy Publish WordPress plugin (versions up to 3.8.3). The issue is due to improper neutralization of input in the brid_override_yt shortcode, where user-supplied attributes are not sufficiently sanitized or escaped. Authenticated attackers with contributor or higher privileges can inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. This vulnerability can lead to information disclosure or session hijacking but does not affect availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and scope change with low confidentiality and integrity impact.

An attacker with contributor-level access or higher can inject persistent malicious scripts into pages via the vulnerable shortcode. These scripts execute in the browsers of users who view the infected pages, potentially leading to unauthorized actions such as session hijacking or data theft. The vulnerability does not impact system availability. There are no reports of active exploitation in the wild.

No official patch or fix has been released for this vulnerability as of the provided information. Users should monitor the vendor's advisory channels for updates. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the Target Video Easy Publish plugin if feasible. Employing web application firewalls that detect and block XSS payloads may provide some mitigation but are not a substitute for a proper patch.